You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Debt rates will be wrongly set when debt is repaid
Summary
In executeRepay interest rates are updated before the debt is repaid, causing the new debt rates to be calculated wrongly as vars.totalDebt will be set to a value prior to the repayment.
Root Cause
In executeRepay the interest rates are calculated before the debt is actually repaid and the previous value of totalSupplies.debtShares, prior to the repayment, is used when getting vars.totalDebt. vars.totalDebt is used when calculating what the debt rate should be when calling calculateInterestRates. Thus, as the total debt includes the debt that is removed/repaid, vars.totalDebt will be higher, causing the borrow rate to be higher than expected.
Internal pre-conditions
No response
External pre-conditions
No response
Attack Path
No response
Impact
The borrow rate will be higher than expected after debt is repaid. This causes a loss of funds for borrowers and potential unexpected liquidations as borrowers will have to account for the higher borrow rate.
PoC
No response
Mitigation
The borrow rate should be updated after the debt is repaid, just as it is currently done in executeBorrow. In executeBorrow when updateInterestRates is called the new value of _cache.nextDebtShares is used.
sherlock-admin3
changed the title
Curly Pineapple Armadillo - Debt rates will be wrongly set when debt is repaid
trachev - Debt rates will be wrongly set when debt is repaid
Oct 3, 2024
trachev
Medium
Debt rates will be wrongly set when debt is repaid
Summary
In
executeRepay
interest rates are updated before the debt is repaid, causing the new debt rates to be calculated wrongly asvars.totalDebt
will be set to a value prior to the repayment.Root Cause
executeRepay
the interest rates are calculated before the debt is actually repaid and the previous value oftotalSupplies.debtShares
, prior to the repayment, is used when gettingvars.totalDebt
.vars.totalDebt
is used when calculating what the debt rate should be when callingcalculateInterestRates
. Thus, as the total debt includes the debt that is removed/repaid,vars.totalDebt
will be higher, causing the borrow rate to be higher than expected.Internal pre-conditions
No response
External pre-conditions
No response
Attack Path
No response
Impact
PoC
No response
Mitigation
The borrow rate should be updated after the debt is repaid, just as it is currently done in
executeBorrow
. InexecuteBorrow
whenupdateInterestRates
is called the new value of_cache.nextDebtShares
is used.Duplicate of #413
The text was updated successfully, but these errors were encountered: